anavira[.]com

This domain, anavira.com, is actively distributing crypto drainer malware designed to automatically siphon digital assets from connected wallets. Analysis indicates the site employs deceptive tactics, such as fake token airdrops or wallet verification prompts, to trick users into authorizing malicious transactions. Once permissions are granted, the drainer executes unauthorized transfers, often emptying wallets within seconds. The threat is particularly dangerous for users of decentralized finance platforms or those holding cryptocurrency in hot wallets. Infrastructure analysis reveals multiple red flags confirming the malicious nature of this domain. Anavira.com was registered on March 30, 2019, through Tucows Domains Inc., and currently resolves to the IP address 20.62.253.20. The domain appears on two security blocklists and is flagged by 5 out of 95 security vendors on VirusTotal, including detections for phishing and malware distribution. Additionally, it is listed in three AlienVault OTX threat intelligence pulses, further corroborating its association with malicious activity. The site’s SSL certificate, issued by Let’s Encrypt, does not mitigate the risk, as threat actors frequently use valid certificates to lend false legitimacy to phishing infrastructure. If you have visited anavira.com or interacted with its content, immediate action is required to mitigate potential damage. First, disconnect any wallets or browser extensions linked to the site and revoke all permissions granted to unknown or suspicious smart contracts using a blockchain explorer. Scan your device with updated security software to detect and remove any malware that may have been downloaded. Monitor your wallet transactions for unauthorized activity and consider transferring remaining assets to a new, secure wallet if compromise is suspected. Report the domain to relevant security platforms to aid in broader threat mitigation efforts.